Adobe Commerce and Magento Open Source Stored Cross-Site Scripting Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Commerce and Magento Open Source. This issue affects versions through 2.4.9-alpha3, as well as several other version ranges. The vulnerability allows a high-privileged attacker to inject malicious scripts into form fields, which could then be executed when a victim interacts with the page containing the compromised field.

Impact

Exploitation of this vulnerability could lead to stored Cross-Site Scripting, allowing injected scripts to be executed in the context of the user.

Remediation

Users are advised to update to Adobe Commerce 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17. For Magento Open Source users, the recommended versions are the same as for Adobe Commerce. Instructions for updating can be found in the release notes for each version.